On 15/02/2019 10:04, Lucas De Marchi wrote: > > ooh, this ifdef is messy. Why do we want both libressl and openssl? What > distro is requiring that? Well, in the kernel in scripts/sign-file.c the same ifdefs are used. Every distro that tries to support LibreSSL requires that. I know at least Gentoo [1], Alpine and Void. > if in the end we end up with ifdefs for N different libs I'd rather just > add the implementation in kmod itself or convince kernel guys to just > fill out the struct they are supposed to fill. If you don't like ifdefs at all I would say that CMS is not needed. CMS and PKCS#7 formats are very similar. CMS is newer but is as much as possible backward compatible [2], but PKCS#7 is better supported. PKCS#7 has all the same fields that are used when a kernel module is signed using CMS (and otherwise). For example I can sign a module using OpenSSL-1.1.1 and CMS (even with hashes other than sha1) and read its signing information with modinfo and PKCS#7 on a system with LibreSSL, and otherwise. So we can just replace CMS with PKCS#7 in fill_pkcs7(). [1] https://bugs.gentoo.org/677960 [2] https://tools.ietf.org/html/rfc5652#section-1.1 -- Stefan
